YOUR CLOSET. YOUR CHOICES.

Pilot privacy notice

Effective October 20, 2026. Hemhop is operated by Heitman International Solutions & Services, LLC (HISS LLC), a Georgia company. Contact support@hemhop.com about privacy, access or removal requests.

This notice describes the pilot’s data handling. Public pages include sample inventory and demo reservations. Live student payments and personal-photo virtual try-on remain unavailable. Optional AI features are available only where their separate controls and notice are active.

Accounts and shared closets

Campus sign-in uses an email code. Account records may include your campus email, chosen display name and handle, campus, listings and garment images, follows, and the profile preferences you choose to save. An email domain check establishes access to that mailbox; it is not a background check or a guarantee about another student.

Your published closet, listing details and opted-in Instagram link can be seen by people allowed to browse them. Do not put a home address, phone number or private document in a public listing. An Instagram handle is a link you choose to add; Hemhop does not import your Instagram password, followers or private messages.

Private plans and sharing

Fit preferences, rental budgets and private friend boards are restricted account features. Board access depends on invitations and membership. Choose recipients carefully: an authorized recipient can still copy information outside Hemhop. We do not promise that any internet service can prevent every disclosure.

The personal body-photo preview is paused and its photo inputs are disabled. Do not send body photos through support or bug reports. Garment-condition evidence should show the garment without a person, identifying document or unrelated private information.

Support and bug reports

Email to support@hemhop.com is received through Resend and forwarded as plain text to the two approved owners. The forwarding workflow excludes HTML, remote images and attachments. The original email may still exist in Resend and the sender’s or recipients’ mail services. Owners can use the private console to reply as Hemhop.

Bug reports contain the title, category, steps, expected result, actual result and optional campus that you enter. If you opt in, they also include only a general page area, device-size class and app version. The report form does not attach screenshots, photos, full page addresses, browser history, other form fields or automatic console logs. Avoid passwords, email codes, API keys, payment details and personal messages in your description.

Signed-in reporters can see their own report status. Authorized owners can review reports and add private triage notes. Internal notes and owner audit records are not displayed in student report history. Signed-out sign-in reports provide a receipt reference without public report lookup.

Optional AI help

When an AI form is enabled, it asks for your consent before sending that question and reviewed Hemhop guidance through our server to OpenAI. It does not automatically attach a closet, bug report, support thread, body photo, measurements or private board. Do not enter personal or account secrets. AI suggestions can be mistaken and do not decide disputes, authorize refunds or change account access.

AI requests use a server-side credential and request that responses are not stored as API conversation state. This does not mean all provider retention is eliminated. Our usage ledger stores request references, digests and accounting information rather than question or answer text.

Service providers and device storage

Hemhop uses Sites hosting, Supabase for account/database services, Resend for email and OpenAI for separately enabled AI questions. Information is shared with these providers as needed to perform those services. Payment providers conduct their own verification under their notices when a payment service is activated; Hemhop does not ask for banking credentials in ordinary support fields.

Browser storage can retain demo preferences, saved looks and locally entered demonstration records. Clear site data on shared devices and sign out of your account. Owner sessions and private support/AI drafts are kept in memory and clear when the console locks, signs out or leaves the view. Email content and any copy already sent to another service are separate.

Retention and your requests

We retain account, support and issue records while needed to operate the pilot, investigate an issue and meet applicable obligations. This release does not provide automatic deletion across every provider or recipient mailbox. Contact support to request access, correction or deletion; we will verify the request proportionately and explain records that must be retained, including required financial, security or dispute evidence. Never send a password or sign-in code to prove identity.

You may remove optional profile information and revoke board sharing through the available account controls. Removing a link or membership cannot recall a copy already made by another person. The pilot is intended for adult college students; contact support before participating if you are under 18.

Changes and concerns

Material changes will be reflected in this notice and the relevant consent flow. Report a suspected security or privacy problem directly to support and avoid posting sensitive evidence publicly. This notice does not remove rights provided by applicable law.